Hacker News Reader

Comment by hmmm-i-wonder | Hacker News Reader

The TRO was filed for and granted without DigiCerts input. By the time they responded, both parties filed to vacate the TRO (3 days later). Judges I expect weigh, to the best of their abilities, the perceived harm in granting/not granting the TRO. Considering the technical literacy of our court system I expect that leaves much to be desired

View on HN

It was filed and granted without DigiCerts input, yes, but DigiCerts lawyer showed up within 24 hours but then did not do anything. See the courtlistener link: https://www.courtlistener.com/docket/68995396/alegeus-techno...

Timeline:

Jul 30, 2024 - ORDER granting 2 Ex Parte Motion for TRO. IT IS HEREBY ORDERED that DigiCert is prohibited from revoking the security certificates for the Alegeus Websites for a period of seven (7) day

Jul 31, 2024 - NOTICE of Appearance by Jess M. Krannich on behalf of DigiCert

...

Aug 3, 2024 - DOCKET TEXT ORDER. 9 Joint Motion to Vacate 3 Order Granting Ex Parte Motion for TRO is GRANTED

Looking at that timeline, I can see why other CA forum members are asking "are you really taking this seriously?" The whole point is that such a restraining order was definitely a bad call by the judge and should absolutely have been contested immediately by any legal team that was interested in representing the security interests of the CA Browser Forum (which, ya know, members of the CA Browser Forum should do in such cases, hence why they're in the CA Browser forum). The fact that DigiCerts legal team did show up for that TRO and then did not act to try to defend their ability to secure their certs, is a bad thing. If you want to be a CA, you gotta be willing to defend your need to act in the name of security, and to defend that in a social, business, and legal context. The point of CAs in the world is not to make money, it is to provide security services. Responding with "hey, but my legal obligations in my country mean I can't always do that" is a valid explanation, but it also means that the rest of the CA Browser Forum should probably not trust you.

Any CA who believes that the courts in their country could not prevent them from revoking certificates is confused at best.

It's true that DigiCert could have refused to cooperate with Alegeus and fought the court order instead of cooperating with them to rotate the certificates ASAP. But that would have taken a lot longer than 5 days, even if they eventually won. If the CA Browser Forum has such a strong security interest in swift revocation, it's hard to see how further delaying the revocation in order to provoke a legal battle promotes that interest.

Ah yes, I missed that note, thanks.

I'll point out notice of appearance doesn't mean they COULD have done anything. The TRO was granted for 7 days already.

From a strategic position, they probably saw they could work with the client and withdraw the TRO faster and cheaper than challenging the TRO in court. Its unlikely a challenge would have significantly decreased the time they were required to not act under the TRO.

They could have revoked the certificates of companies not listed in the TRO. Instead revocations for _all_ customers were delayed by 3 days over the time limit [1].

Additionally, it seems more prudent to me that they should drop Allegius as a customer than make the guy resign. The current situation seems like if an issue occurs again then DigiCert will not revoke the certs according to the timeline they committed to (24h).

[1]: https://bugzilla.mozilla.org/show_bug.cgi?id=1910805#c11

Agreed on both counts (I made the same points in other comments :))

Reply on news.ycombinator.com